Skip to main content
Skip table of contents

EVID : 1024 Epo Infected File Deleted

Vendor Documentation

https://kcm.trellix.com/corporate/index?page=content&id=KB54677

Classification

Rule Name

Rule Type

Classification

Common Event

Evid : 1024 Epo Infected File Deleted

Base Rule

Failed Malware

Failed Malware Activity

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

N/AN/AN/AN/A
MachineNameN/AN/AName of the system hosting the detecting product.
AgentGUIDN/AN/AUnique identifier of the agent that forwarded the event.
IPAddress<dip>IP AddressIP address of the system hosting the detecting product (if given in the event).
OSNameN/AN/AN/A
UserNameN/AN/AN/A
TimeZoneBiasN/AN/AN/A
RawMACAddress<dmac>Text/StringMAC address of the system hosting the detecting product.
ProductName<vendorinfo>Text/StringName of the detecting managed product.
ProductVersion<version>Text/String/NumberVersion number of the detecting product.
ProductFamilyN/AN/AN/A
AnalyzerN/AN/AN/A
AnalyzerNameN/AN/AName of the detecting managed product.
AnalyzerVersionN/AN/AVersion number of the detecting product.
AnalyzerHostNameN/AN/AName of the system hosting the detecting product.
AnalyzerEngineVersionN/AN/AVersion number of the detecting product’s engine (if given in the event).
AnalyzerDetectionMethodN/AN/AThe name of the task or task type that was responsible for detecting the threat.
AnalyzerDATVersionN/AN/ADAT version on the system that sent the event.
EventID<vmid>NumberUnique identifier of the event class.
SeverityN/AN/AN/A
GMTTimeN/AN/AN/A
ThreatCategory<subject>Text/StringCategory of the event. Possible categories depend on the product.
ThreatEventIDN/AN/AUnique identifier of the event class.
ThreatSeverity<severity>NumberThe severity of the detected threat as defined by each managed product.
ThreatName<threatname>Text/StringName of the threat.
ThreatTypeN/AN/AClass of the threat.
DetectedUTCN/AN/AN/A
ThreatActionTaken<action>Text/StringThe action taken by the product in response to the threat.
ThreatHandled<result>Text/StringSpecifies whether the action taken was successful.
SourceHostName<sname>Text/StringSystem name from which the threat originated (if given in the event).
SourceProcessName<process>Text/StringThe process name from which the threat originated.
TargetHostName<dname>Text/StringName of the system that created the event.
TargetUserName<domainimpacted>
<account>		Text/StringThe threat source user name or email address.
Target FileName<object>Text/StringLocation of the threat on the detecting system.
targetN/AN/AN/A
BladeNameN/AN/AN/A
AnalyzerContentCreationDateN/AN/AN/A
AnalyzerGTIQueryN/AN/AN/A
ThreatDetectedOnCreationN/AN/AN/A
TargetName<objectname>Text/StringN/A
TargetPathN/AN/AN/A
TargetHash<hash>Text/StringN/A
TargetFileSize<size>NumberN/A
TargetModifyTimeN/AN/AN/A
TargetAccessTimeN/AN/AN/A
TargetCreateTimeN/AN/AN/A
CleanableN/AN/AN/A
TaskNameN/AN/AN/A
FirstAttemptedActionN/AN/AN/A
FirstActionStatus<status>Text/StringN/A
SecondAttemptedActionN/AN/AN/A
AttackVectorTypeN/AN/AN/A
DurationBeforeDetectionN/AN/AN/A
NaturalLangDescriptionN/AN/AN/A
DetectionMessageN/AN/AN/A
AMCoreContentVersionN/AN/AN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close